Splunk Answers-a-thon!

How can I set up notable events and correlation searches in Splunk ES?

yeasuh
Community Manager
Community Manager

How can I set up notable events and correlation searches in Splunk ES?

Labels (2)
0 Karma

ejahnke
Explorer

Hey yeasuh,

head over to https://docs.splunk.com/Documentation/ES/7.1.1/Tutorials/CorrelationSearch

Assuming you already got an idea for a CS you Skip to Part 2 and follow the instructions there. You could also use the guided mode, if youre not that comfortable with using SPL.

For the notable part: Go to Step 5 and chose the adaptive response action "Notable ". The docs are pretty thorough and should anwers all your questions. If you got any more questions after going thru the docs just hit me up. Cheers!

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...